Research map / Adversarial robustness and security / Attacks on text and graphs
Semantic-Aware Multi-Label Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GMLA, a semantic-aware targeted adversarial attack for multi-label learning that expands the target set via a WordNet knowledge graph and projects the target-label gradient orthogonal to non-target-label gradients.
Problem
Adversarial attacks on multi-label learning models often flip unrelated labels and produce semantically inconsistent predictions, and naively preserving other labels yields negatively correlated gradients that reduce attack effectiveness.
Approach
Find a minimal knowledge-graph-consistent superset of the target labels (consistent target set), then optimize the attack on that set under a constraint that other labels' BCE loss is unchanged, implemented as projecting the gradient onto the orthogonal complement of the non-target gradient (AutoPGD-style, closed form for l-infinity).
Key results
- On PASCAL-VOC with ML-GCN at epsilon=0.01, GMLA reaches FRS of 99.4% (|Ω|=1) versus 75.5% for MLA-U and 68.9% for MLA-C, with NTR of 2.7 versus 4.9 for MLA-U.
- On OpenImages with ASL at epsilon=0.05, MLA-C's NTR drops to 0 for |Ω|=5 but its fooling rates collapse, while GMLA maintains high semantic fooling rates.
- GMLA attains FRN comparable to baselines (near 100%) while substantially outperforming them on the semantic-based FRS metric across three models and three datasets.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GMLA instead of MLA-U | ML-GCN · PASCAL-VOC, |Ω|=1, ε=0.01 | FRS: 75.5 -> 99.4 | Helped |
| Use GMLA instead of MLA-U | ML-GCN · PASCAL-VOC, |Ω|=2, ε=0.01 | FRS: 68.0 -> 98.4 | Helped |
| Use GMLA instead of MLA-U | ML-GCN · NUS-WIDE, |Ω|=1, ε=0.01 | FRS: 43.5 -> 95.8 | Helped |
| Use GMLA instead of MLA-U | ML-GCN · NUS-WIDE, |Ω|=2, ε=0.01 | FRS: 31.7 -> 91.3 | Helped |
| Use GMLA instead of MLA-U | ML-GCN · PASCAL-VOC, |Ω|=1, ε=0.01 | FRN: 100.0 -> 100.0 | No clear effect |
| Use GMLA instead of MLA-U | ML-GCN · NUS-WIDE, |Ω|=1, ε=0.01 | NTR: 1.5 -> 0.5 | Helped |
| Use GMLA instead of MLA-U | ML-GCN · NUS-WIDE, |Ω|=2, ε=0.01 | NTR: 1.6 -> 0.4 | Helped |
| Increase target-set size from |Ω|=1 to |Ω|=2 | GMLA on ML-GCN · PASCAL-VOC, ε=0.01 | FRS: 99.4 -> 98.4 | No clear effect |
Surprising findings
- Adding a loss to preserve non-target labels yields gradients highly negatively correlated with the target-label gradient, counteracting the attack; this worsens with more labels.
- MLA-LP often has an empty feasible region for its linear constraints and fails to converge on OpenImages.
Limitations
- Semantic consistency depends on the quality of the WordNet/OpenImages knowledge graph hierarchy.
- Evaluated only in white-box setting with l-infinity perturbations on three MLL models.
Experimental setup
Datasets: PASCAL-VOC NUS-WIDE OpenImages WordNet
Benchmarks: PASCAL-VOC 2007 test NUS-WIDE test OpenImages test
Metrics: naive fooling rate (FRN) semantic fooling rate (FRS) non-target flip rate (NTR) SSIM
Baselines: MLA-U MLA-C MLA-LP
Builds on: AutoPGD MLA (Song et al. multi-label attacks) WordNet
Closest papers by meaning
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.85)
- Adversarial Training for Defense Against Label Poisoning Attacks (ICLR 2025 · similarity 0.85)
- PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patches (CVPR 2025 · similarity 0.85)
- OSLO: One-Shot Label-Only Membership Inference Attacks (NeurIPS 2024 · similarity 0.85)
- LimeAttack: Local Explainable Method for Textual Hard-Label Adversarial Attack (AAAI 2024 · similarity 0.84)
- Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.